Application Management

Max Field Limit Reached Notification - Loggly

This article helps to address the "MaxFieldLimitReached" notification from the Events in Loggly account.

First published date

9/23/2020 12:16 PM

Last published date

2/4/2026 12:06 AM

Overview

You may normally get "MaxFieldLimitReached" under the "notification" field in your Events in Loggly UI. Please see the following behaviors below when the account is affected by this notification:
  • Fields were missing or events were not parsed or indexed properly
  • When navigating using Dynamic Field Explorer >> LogglyNotifications >> type it is reporting MaxFieldsLimitReached
  • When expanding your Events, under notification field, you see this message like "10 out of 10 fields sent in this event were not indexed due to max allowed"

Product section

Loggly

Cause

You will receive this notification if your field usage on your logs exceeded this limit. 

Resolution

  1. If you are affected, you should report it to Loggly Support. Please refer to Support Policy on how to contact us.
  2. Support will raise this to the backend Engineering Team, subject for their approval in increasing the field usage limit of the account.
  3. Engineering Team will assess the field usage count on the account. 
  4. If approved, they will increase the field usage limit on the account. The number of increasing the limit will be based on the assessment. For this process, there is no estimated time of completion.
  5. Support will revert back to you that the field usage limit has been increased.
  6. You will need to check on your account that fields on the Events are properly parsed and that "MaxFieldLimitReached" is already removed on the "notifications" field.
NOTES:
  • Increasing the field usage limit does not incur any additional cost.
  • There is no manual way of deleting fields in the Loggly UI.
  • There are times when the increase is not approved by the Engineering Team upon assessment. If not approved, users need to monitor their field usage and stop sending the fields that are not important or not needed. Users can ask support for their field usage report for faster review. This procedure is also applicable for maintaining your field usage count.
  • Once stopped, it will take 3 days to rotate the index and create a new index slot. Any fields that were not updated after the index has rotated will NOT be counted against the field limit. See example below:
- day 1 - an event with a field json.field1 is sent and indexed
- day 2 - 3 - no more events with field json.field1 are sent but it is still being tracked and occupies "field limit" slot
- day 4 - new index is created and json.field1 no longer occupies "field limit" slot.
 

Questions:

  1. What if I send json.field2 on day 2, will it be removed on day 4 together with the fields I sent on day 1?  A: No, it will not be removed but we will not count it against the field limit 3 days after the field was last sent to Loggly.
  2. What if I send json.field1 every day starting on day 1, will it be removed on 4th day? A: We'll track the field and if we noticed that there are no events containing json.field1, a new index slot will be created on day 4 and the old field will not be counted against the field limit.